remember me, csrf, ajax

If I leave a authorizationed page open as long as the session timeout(use CookieCsrfTokenRepository), and then send two ajax requests on the page to the server, the first request work good, but the second access denied as csrf token is changed when remember me authentication success, how can i make it work on this condition?

I have modify the CsrfAuthenticationStrategy class like this

@Override
  public void onAuthentication(Authentication authentication, HttpServletRequest request,
      HttpServletResponse response) throws SessionAuthenticationException {
    boolean containsToken = this.csrfTokenRepository.loadToken(request) != null;
    // if RememberMeAuthenticationToken do not refresh csrf token
    if (containsToken && !(authentication instanceof RememberMeAuthenticationToken)) {
      this.csrfTokenRepository.saveToken(null, request, response);

      CsrfToken newToken = this.csrfTokenRepository.generateToken(request);
      this.csrfTokenRepository.saveToken(newToken, request, response);

      request.setAttribute(CsrfToken.class.getName(), newToken);
      request.setAttribute(newToken.getParameterName(), newToken);
    }
  }

and it works good

Start by reading CsrfAuthenticationStrategy and the interaction between CookieCsrfTokenRepository and RememberMeAuthenticationToken during authentication. Reproduce the two AJAX requests after the session timeout, then verify that remember-me authentication does not cause the second request to be rejected while CSRF protection remains effective.